Self-hosted Supabase v0.8.0: Envoy is the default API gateway (breaki…

…ng change)

feat(www): add Open Authorization Integration Addendum (supabase#48804)

<!-- ccr-slack-attribution -->
_Requested by **Nicole Kramer** · [Slack
thread](https://supabase.slack.com/archives/C0161K73J1J/p1786027145751449)_

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Feature — a new legal page on the marketing site (`apps/www`).

## What is the current behavior?

**Before:** the Program Addenda page at
`/legal/partner-resources/program-addenda` lists exactly one addendum,
the Integration Partner Addendum. There is no published Open
Authorization (OAuth) addendum anywhere on the site.

## What is the new behavior?

**After:** the Program Addenda page also lists the **Open Authorization
Integration Addendum**, linking to a new page at
`/legal/partner-resources/program-addenda/oauth-partner-addendum`.
Formatting, breadcrumbs, version selector, and listing badge all match
the existing Integration Partner Addendum.

**How:** three files.

-
`apps/www/data/legal/partner-resources/oauth-partner-addendum/20260806-v1.mdx`
— the addendum text, formatted to match
`integration-partner-addendum/20260615-v1.1.mdx` (escaped section-number
periods, `####` run-in headings for the lettered subsections, italic
`_Label_` run-in labels for the enumerated data-protection clauses,
explicit `[url](url)` links).
-
`apps/www/pages/legal/partner-resources/program-addenda/oauth-partner-addendum.tsx`
— the page, mirroring `integration-partner-addendum.tsx` with a
single-version `versions` array.
- `apps/www/lib/addenda.ts` — adds a small `TITLE_OVERRIDES` map. The
listing derives titles by capitalizing slug words, which turns
`oauth-partner-addendum` into "Oauth Partner Addendum"; the override
makes the listing link read the same as the page's `h1`.

No other wiring was needed: the addenda listing is generated from the
directory, so there is no hub entry, redirect, rewrite, sitemap entry,
or `noindex` rule to add.

## Additional context

Two things for the requester to confirm:

- **The effective date is an assumption.** The addendum document itself
contains no date. The listing and version label derive the effective
date from the `YYYYMMDD` filename prefix, so this file is dated **August
6, 2026**, taken from the source document's own filename (`2026.08.06 -
Supabase-OAuthAddendum-ONLINE.docx`). To change it, rename the file — no
code change required.
- **The legal text is a verbatim transcription.** Source wording,
capitalization, and punctuation are preserved exactly as drafted,
including anything that reads like a typo. Only markup was added; the
plain text was diffed against the transcription and is
character-identical. Please review the wording itself rather than
assuming it was copy-edited.

One wording choice that was not in the source document: the page
subheader, "An addendum to the Master Partner Program Agreement
governing OAuth integrations." It mirrors the one-line subheader style
of the existing addendum page and is easy to reword.

## Also fixed here: a literal `(c)` rendered as `©` in legal headings

While formatting the new addendum we hit a rendering bug that turned out
to be **already live on supabase.com**, not new to this branch.

The heading font, **Manrope**, ships a default-on standard `liga`
feature that maps the glyph sequence `parenleft c parenright` to the
copyright glyph. So a literal `(c)` anywhere inside an `h2`–`h6` on the
marketing site paints as `©`. Body copy is unaffected because it uses
Inter, whose subset has no such ligature — which is why this only ever
shows up in headings.

This branch adds a `legal-prose` utility (`font-variant-ligatures:
no-common-ligatures`) in `apps/www/styles/globals.css` and applies it to
two pages:

- the new **Open Authorization Integration Addendum** page (heading
`#### (c) Security.`), and
- the **Master Partner Program Agreement** page, where the `#### (b)
Such indemnity …` heading in section 17.1 contains `… ; or (c) replace
the Covered Materials …` about 600 characters into the line. That page
was **already published**, and rendered "or © replace the Covered
Materials" in production.

The MPPA change is one word — `className="prose"` → `className="prose
legal-prose"`. **No legal text was modified**: no HTML entities, no
zero-width characters, no rewording, no re-hyphenation. The DOM still
holds `U+0028 U+0063 U+0029`; only the font's shaping is suppressed.
Verified in Chromium against the real heading text and the same two font
subsets `next/font` serves: the `(c)` run measures **15.36px** before
the fix (a single `©` glyph) and **22.05px** after (three literal
glyphs), against a 23.30px control for the `(b)` in the same heading.

All 17 `.mdx` files under `apps/www/data/legal/` were swept for `(c)`
and the other Manrope `liga` input sequences (`--`, `->`, `<-`, `(>)`,
`<3`) on heading lines. The only two hits are the two pages fixed above;
nothing else needs the utility today. (Headings do contain
`ff`/`fi`/`fl`/`tt` — those ligatures are ordinary typography and are
intentionally left alone.)

**For future legal pages:** because the cause is the heading font's
default ligature rather than anything about these documents, any new
legal page whose source has `(c)` in a heading will need `legal-prose`
on its prose container too.

**One side effect worth flagging:** `no-common-ligatures` is blunt, so
on those two pages it also suppresses the ordinary `fi`, `ff` and `tt`
ligatures — a sweep of the legal `.mdx` files counts 107 such
occurrences in headings (`fi` 83, `ff` 21, `tt` 3, `fl` 0), so the note
above about leaving them alone holds for the rest of the site rather
than for these two pages. That is a deliberate trade-off: correctness of
the legal text beats typographic polish on two addendum pages. A
narrower alternative exists — `font-feature-settings: "liga" 0` scoped
to just the offending ligature, or overriding only the
`parenleft_c_parenright` substitution — but it is more fragile and more
subset-specific, so push back here if you would rather have that
instead.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01VtcJJGqw5jL1ESwhs8DGCu

---------

Co-authored-by: Claude <noreply@anthropic.com>

Self-hosted Supabase v0.7.2: update.sh reliability and performance fixes

Self-hosted Supabase v0.7.1: Add update.sh for in-place updates

content(www): update investor logo wall on company page (supabase#47753)

## Summary

- Adds 8 new investor logos: Accel, Craft, Figma, Georgian, GIC, Peak
XV, Salesforce Ventures, Stripe
- Reorders lead investor grid to match design mockup (3 rows of 4)
- Adds per-logo `scale` field to control logo size within each cell
- Adds `grayscaleOnly` field for Salesforce Ventures to preserve tonal
contrast (prevents wordmark from being hidden by `contrast-0` filter)

## Test plan

- [ ] Visit /company and verify all 12 investor logos render correctly
across 3 rows
- [ ] Check logo sizing and order matches the mockup
- [ ] Verify Salesforce Ventures wordmark is visible inside the cloud
shape
- [ ] Check dark mode

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Expanded and reordered the “Our investors” lead cards with additional
entries (including Stripe, Salesforce Ventures, and others).
* Enhanced logo presentation options for lead cards with per-investor
sizing/positioning controls.

* **Bug Fixes**
* Improved lead investor card image rendering by removing internal
scrolling and using an overflow-hidden container with scale-based
sizing.
* Preserved the existing logo filter behavior (opacity-only when
configured, grayscale-only when selected, otherwise the default contrast
treatment).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Danny White <3104761+dnywh@users.noreply.github.com>

Self-hosted Supabase v0.7.0: Breaking API gateway changes

- Data API OpenAPI spec at /rest/v1/ no longer accessible via anon/publishable key
- API_EXTERNAL_URL now includes /auth/v1 (SAML SSO moves to /auth/v1/sso/saml/*)
- PGRST_DB_SCHEMAS default drops the protected storage schema

Self-hosted Supabase v0.6.0: Postgres 17 as the default

Self-hosted Supabase v0.5.1: Security fix for Realtime routes

Self-hosted Supabase v0.5.0: Postgres 15 baseline

chore: Bump `next` in `www` app (supabase#45701)

This PR bumps `next` in `www` app to fix a vulnerability.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Updated framework to the latest patch version, incorporating bug fixes
and performance improvements from recent releases.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->